This week, Apple released more updates for the actively exploited zero-day CVE-2022-32893 – an out of bounds write issue that allows attackers to execute arbitrary code with kernel privileges, ultimately taking over an entire system.
The update, iOS 12.5.6, impacts the following:
The patches are for older devices running older versions of iOS, indicating that Apple may have come across some high-profile or high-risk users of older devices who were compromised. Earlier in August 2022, Apple patched a kernel vulnerability tracked as CVE-2022-32894. Apple stated in their advisory that iOS 12 is not impacted by CVE-2022-32894 but it is vulnerable to CVE-2022-32893.
All users impacted by CVE-2022-32893 and CVE-2022-32894 should implement the security updates as soon as possible. For guidance on how to update your device, please visit Apple’s Support page.
Apple released security updates for vulnerabilities found in iOS, iPadOS, MacOS Big Sur, and macOS Monterey. CVE-2022-32894 and CVE-2022-32893 are zero-day flaws that contain code execution vulnerabilities being exploited by attackers in the wild. There are few details surrounding the vulnerabilities or how they were leveraged, but the flaws are believed to be exploited for targeted attacks.
CVE-2022-32894 is an out-of-bounds write issue that allows attackers to execute arbitrary code with kernel privileges, ultimately taking over an entire system. CVE-2022-32893 is a WebKit flaw that allows attackers to execute arbitrary code through maliciously crafted web content. WebKit is a browser engine that powers Safari and other iOS web browsers. The bug can be triggered by processing maliciously crafted web content, which can then lead to arbitrary code execution.
Apple released updates to patch both vulnerabilities:
All users impacted by CVE-2022-32983 and CVE-2022-32984 should implement the security updates as soon as possible.
Please patch your device as soon as possible. You can find guidance on security updates at the links below:
While Apple products are not widely used at an enterprise level, these devices could provide an attack vector to company executives. Avertium is raising awareness among our customers to patch this vulnerability before it is too late.
INDICATOR'S OF COMPROMISE (IOCS):
Related Reading: Zeppelin Ransomware Targets Healthcare